CVE-2026-128239 in GPAC
Summary
by MITRE • 11/13/2026
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in GPAC versions up to 26.07.0 represents a critical memory safety flaw located within the MPEG-4 form spatial-constraint handlers found in the source file src/compositor/mpeg4_form.c. This specific defect is classified as a NULL pointer dereference, which occurs when the application attempts to access a memory location that has not been properly initialized or allocated. In this context, the issue arises during the processing of XMT scene files, specifically when handling Form constraints that reference group identifiers. The root cause lies in insufficient validation logic within the codebase; when an attacker supplies a crafted input file where these constraints point to non-existent groups, the software fails to verify the existence of the referenced entity before attempting to retrieve it from internal data structures.
From a technical perspective, the operational mechanism involves the group lookup function returning a null value because the specified identifier does not correspond to any active or defined object in the scene graph. Instead of handling this absence gracefully through error checking or fallback mechanisms, the subsequent code proceeds to dereference this null pointer. This action triggers an immediate segmentation fault or access violation within the operating system's memory management unit. Consequently, the process executing GPAC tools such as MP4Box terminates abruptly and unexpectedly. This behavior is particularly problematic during operations like chapter import, where complex scene structures are parsed and rendered, making it a prime vector for exploitation against users who handle untrusted multimedia content.
The impact of this vulnerability is primarily centered on denial of service conditions affecting the stability and availability of GPAC-based applications. By crafting specific XMT files with malformed spatial constraints, an attacker can reliably crash the application without requiring any further privileges or user interaction beyond opening the file in a vulnerable version of the software. This disrupts workflows involving media processing and rendering, potentially leading to data loss if unsaved work is involved. While the primary impact observed is local denial of service, such memory corruption bugs often serve as precursors to more severe exploits, including arbitrary code execution, although no evidence suggests remote code execution capabilities in this specific instance due to the nature of the crash being a simple null dereference rather than heap overflow or use-after-free scenarios.
In terms of industry standard classifications, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, highlighting the failure to check for null values before accessing memory. It also relates closely to CWE-20 Improper Input Validation, as the core issue is the lack of rigorous checks on user-supplied data regarding group existence prior to processing. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior falls under T1499 Endpoint Denial of Service, specifically reflecting techniques that exploit software vulnerabilities to disrupt service availability rather than compromising confidentiality or integrity directly.
To mitigate this risk, immediate updates to GPAC are recommended for all users relying on versions prior to 26.07.0 if a patched release is available in the official distribution channels. Developers integrating GPAC into their pipelines should implement defensive programming practices by validating input data structures thoroughly before passing them to compositor functions. Specifically, any function that performs group lookups must include explicit checks for null return values and handle such cases appropriately, either by logging an error or skipping the invalid constraint rather than proceeding with dereferencing. Additionally, employing fuzzing techniques during development can help identify similar edge cases in scene parsing logic before they reach production environments, ensuring robust handling of malformed multimedia inputs.